PT-2007-2180 · Apple · Macos X+1

Publicado 2007-04-24 · Atualizado 2011-03-08 · CVE-2007-0729

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.9 through 10.4.9

Description The issue concerns the Apple File Protocol (AFP) Client, which does not properly clean the environment before executing commands. This allows local users to gain privileges by setting unspecified environment variables.

Recommendations For versions 10.3.9 through 10.4.9, consider restricting the execution of commands by the AFP Client until a fix is available, and avoid setting sensitive environment variables that could be exploited.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-0729

Produtos afetados

Apple File Protocol (Afp) Client

Macos X

Referências · 10

• http://securitytracker.com/id?1017944 · Nota
• http://us-cert.gov/cas/techalerts/TA07-109A.html · Nota
• http://osvdb.org/34858 · Nota
• http://kb.cert.org/vuls/id/312424 · Nota
• http://secunia.com/advisories/24966 · Nota
• http://securityfocus.com/bid/23569 · Nota
• http://vupen.com/english/advisories/2007/1470 · Nota
• http://docs.info.apple.com/article.html?artnum=305391 · Correção
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0729 · Nota de Segurança